H33-74 for Insurance

What gets attested in insurance

Each of the following operational events emits an H33-74 proof at the moment it occurs. The collection composes into the operational history that audit, compliance, and regulatory teams reconstruct from.

• Underwriting decisions: bind, decline, refer, exception, conditional.
• Claim approvals, denials, reserves changes, partial payments.
• Reinsurance allocations: facultative, treaty, retrocession.
• Subrogation actions: pursuit, settlement, write-off.
• Denial appeals: receipt, review, escalation, final disposition.
• Catastrophe response decisions: declaration, reserve adjustment, accelerated payment.
• Policy framework changes: rate filing, form filing, regulatory approval.

Regulatory pressure that already justifies this

Insurance is regulated under frameworks whose audit horizons now extend past the lifetime of the systems and vendors holding the evidence. H33-74 produces evidence that survives that horizon:

• SOX. Publicly listed insurance holding companies. See: SOX crosswalk
• DORA. EU insurers under DORA scope. See: DORA crosswalk
• GDPR. Personal data processing in underwriting and claims. See: GDPR crosswalk
• EU AI Act. High-risk AI in claims and underwriting. See: EU AI Act crosswalk
• NAIC Model Audit Rule. Internal controls over financial reporting.

Scenarios this changes

Insurer migrates from one core insurance system to another

Every claim decision, underwriting determination, and reinsurance allocation from the old system remains independently verifiable. The new system inherits zero historical liability and zero audit risk from the change.

A class action requires proof of claim decisions four years ago

The original PQ-signed proofs are produced. The model version, adjuster signature, evidence reviewed, and policy framework in effect are all in the proof. No reconstruction from secondary records.

Regulator inquiry about an AI-flagged claim denial

The proof contains the AI score, the policy applied, the human reviewer, the final disposition, and the appeal chain. The regulator verifies directly without operator cooperation.

What survives versus what gets replaced

How to start

Three integration patterns, ordered by how invasive each is.

Pattern 1 — Receipt at the policy engine

The decision system (policy engine, approval workflow, AI scorer) emits an H33-74 proof for every decision at the moment it is made. No change to upstream systems. Auditors verify proofs directly.

Pattern 2 — Receipt at the system of record

Each system of record (treasury, claims, records, EHR) is wrapped so that committed transactions emit H33-74 proofs in addition to the existing audit log. Existing systems remain unchanged. Proofs become a parallel canonical record.

Pattern 3 — Receipt at the integration bus

Service mesh or integration bus intercepts cross-system events and emits H33-74 proofs. Highest reach, requires bus integration. Useful where systems-of-record cannot be modified.

Related